Then she remembered this little place by the College Station Medical Center she had seen while going to her doctors. The restaurant is Luigi’s Patio Ristorante, and it is located in a little shopping center at the intersection of highway 6 north and Rock Prairie road. They have directions on their website here. I had never seen it before and I’m always willing to try out new restaurants and food, so we headed that way.

The outside of Luigi’s is nothing special… it’s true beauty is inside. They have done an exquisite job of decorating the interior so that you forget you are in College Station, TX. When you walk in you are instantly transported to a patio in Italy! We noticed a little band stage when we arrived at 6:00 PM, but they did not play until 9:00. I was kind of bummed because I really enjoy live jazz music.

We started the meal off with an order of calamari that was absolutely fabulous. Sometimes calamari can be over cooked which makes it too hard, or the batter used is too thick. However, the calamari was perfectly cooked and breaded and the marinara sauce and tartar sauce that came with it was fresh and delicious. We usually stick with one appetizer, but we decided to order some soup. We figured if the calamari was that good the soup had to be good too.

We decided to split a bowl of the minestrone and it came out pretty quickly. Hands down it is the best minestrone I’ve ever had in my life. It was chocked full of vegetables and just the right amount of pepper and seasoning. Whoever prepared the soup knew exactly what they were doing in making perfect soup! Typically this is where the meal comes in, but again because the soup was so good we decided to go for the other soup on the menu - a tomato basil.

This is but one of the parts of the story where the plot crescendos for Luigi’s hospitality. My wife doesn’t really like tomato basil but she was really craving a cream based tomato soup. Unfortunately, the waiter informed us, the tomato soup of the night was not cream based. He saw the disappointment on my wife’s face and whisked away to the kitchen. Within 10 minutes the chef had prepared - from scratch - a cream based tomato basil soup just for her! I’m lactose intolerant so I typically try and stay away from heavy cream. But this soup was, again, perfect! I would go there again just to have a taste of that soup and I would bring my lactaid! I cannot describe in words the wonderfulness of the soup they make, but suffice to say you will have to go there to experience it for yourself.

Did I mention the bread? My wife and I love bread with our meal so we requested some with our soups. The waiter brought what I think was some type of sour dough or ciabatta bread with extra virgin olive oil on it. It was still warm and we are pretty sure they prepare it fresh each time they bring it out. We asked for more after the first plate was gone and the second batch came out just a little different. It gave the bread a personality you usually only find in homemade bread.

After a bit of good conversation the main course arrived. My wife had chicken fettuccini alfredo that was delicious and I had penne con funghi porcini which was again delicious. The servings were huge and neither of us finished our main course. I would have taken it home but we were headed to a movie and I didn’t want it to spoil in the car. I miss my bowl of pasta :(. Based on these two meals I would guess you can’t find anything bad on the menu (PDF).

Finally, we arrived at dessert. We usually don’t order dessert but the waiter did a fantastic job of describing their special dessert of the evening. I cannot recall the name of the dessert, but it was two slices of multi-layered walnut vanilla and chocolate ice cream, and pistachio gelato with an orange grenadine soaked slice of sweet cake between the ice cream and the gelato. The whole thing was garnished with fresh blueberries and blueberry syrup. Even though I’m lactose intolerant I made an exception because of the wonderful flavor.

After dinner, we went and saw Marley and Me, which was wonderful. I’ll save that for another post because I cried like a baby at the end of it (as all the reviews said I would). The interesting part here is that I left my credit card at the restaurant! I must have been talking about the great experience and left it in the ticket book. They are open until midnight on Saturday so we drove back to pick up my card.

Again, walking into the restaurant is an experience in and of itself. We talked to the manager (I’m guessing) and he went to get our card. The great thing about this is that he actually asked for ID before handing the card over. I respect that he had the foresight to question me before handing over the key to my castle so to speak.

He also informed us that the band was about to start playing so we decided to sit down and listen. The manager then started playing saxophone in the band! The jazz music was great and I wish we could have stayed and listened longer. We were both getting tired (as all parents of small children do around 10 PM) so we had to leave. Just as we were getting ready to leave, the owner (again a guess - he was an older man with a lot of soul, and he is featured on their website) started playing a clarinet solo. Again, fascinating music that just added even more to the atmosphere!

All in all, we are very very glad we went to Luigi’s and have decided to make it a regular in our date nights. We ended up getting out right around $60 (including tip) for a very nice dinner date. I would not take our child there because it might disturb the atmosphere. But I’m sure when she gets older we will include her in the great experience!

I started digging into the blogosphere and found an article by Tim Barcz describing how to fix NAnt for .NET 3.5. This lead me to doing a little poking around in the NAnt.exe.config file, and I found the following registry key search:

<readregistry
property=”sdkInstallRoot”
key=”SOFTWARE\Microsoft\Microsoft SDKs\Windows\v6.0A\WinSDKNetFxTools\InstallationFolder”
hive=”LocalMachine”
failonerror=”false” />

The funny thing about that registry key is that it exists when you install Visual Studio, but not when you install the latest SDK. I did not want to alter the config file because on developer machines in a large team, you’re more likely to see Visual Studio installed than not. The above registry key is found then, and everything works. But for a build server where the basics are installed (CruiseControl.NET, Subversion, and the Windows SDK v6.1), this doesn’twork out so well.

What I ended up doing was creating a registry key on the build server that mimiced the above key, but actually pointed to the 6.1 SDK. Once NAnt can find the installed SDK path, it actually links to the proper libraries (usually found in C:\Windows\Micrsoft.NET\Framework\v3.5 and v3.0 respectively). This keeps the NAnt config file the same, thus sparing developers from having to modify their registry, and fixes the build server so it can compile against .NET 3.0 and 3.5 libraries.

I have added FxCop to the automation on several projects I run and found out the hard way just what Microsoft thinks of my code. Actually, there were not a lot of code errors that were show stoppers. Most of the errors came from the Microsoft.Design and Microsoft.Performance rule sets of FxCop. I also had a strong naming error on all my libraries, which I fixed with some quick public/private keypair generation tools (more on this later).

So today’s post is about automating FxCop and fixing some of the likely rule violations you are going to see in your output. You can also follow the FxCop Blog at http://blogs.msdn.com/fxcop/.

FxCop Setup and NAntContrib

The first thing to do is download and install FxCop. FxCop is only available as an executable so you have to install it first and then copy the files it puts in the installation path you specify to your project’s tools directory. This process is pretty straight forward and there are no other dependencies you have to resolve to get FxCop working from your project repository without having it installed on the development computer you are working on.

The second thing to do (if you haven’t already) is download and install NAntContrib. NAntContrib contains a lot of useful tasks that NAnt does not, including the fxcop task. In my project’s repository I have FxCop in ${root.dir}\tools\FxCop and NAntContrib in ${root.dir}\tools\NAntContrib.

NAnt Build File Setup

First you have to make the NAntContrib tasks available to your build files. I use properties to specify paths in my projects so I can reuse them in submodules of my project. For this example, we will assume you have set these up, along with the properties set below. The following should be put at the top of your build right under the project element:

<property name=”root.dir” value=”.” />
<property name=”build.dir” value=”${root.dir}\build” />
<property name=”tools.dir” value=”${root.dir}\tools” />
<property name=”tools.nantcontrib.dir” value=”${tools.dir}\NAntContrib” />
<property name=”tools.fxcop.dir” value=”${tools.dir}\fxcop” />

<!– Load the NAntContrib Tasks –>
<loadtasks assembly=”${tools.nantcontrib.dir}\NAnt.Contrib.Tasks.dll” />

The Build Target

The next thing to do is define a build target that will compile your code. Before I added FxCop, here is what my build target looked like:

<target name=”build” depends=”clean,init” description=”Compiles the code into a DLL”>
<property name=”compile.dir” value=”${project::get-name()}.Source” />
<csc target=”library” output=”${build.dir}/${compile.dir}.dll” debug=”${debug.compile}”>
<sources>
<include name=”${compile.dir}/**/*.cs” />
</sources>
<references>
<!– Put necessary references here –>
</references>
</csc>
</target>

Setting Up the Environment for FxCop

Since we have loaded NAntContrib, the fxcop task is available to us, but we first have to do some setup. The fxcop task assumes that  the FxCop executable (FxCopCmd.exe) is available from somewhere in your PATH environment variable. Since we removed it from Program Files, this is no longer true and we need to add the path to the FxCop directory to our PATH environment variable. We don’t want this to be permanent however since we don’t really want to mess with the environment any more than is necessary for our build to run. The following code should be placed under the properties and loadtask stuff we put in our build file earlier:

<!– FxCop PATH Resolution –>
<if test=”${not property::exists(’setFxCopPath’)}”>
<setenv name=”PATH” value=”${environment::get-variable(’PATH’)};${tools.fxcop.dir}” />
<property name=”setFxCopPath” value=”true” />
</if>

You don’t actually need the if statement when using only one build file. I put this in a global properties file that is loaded in each build file. However, I do not want the PATH variable to be inundated with the fxcop directory so I test to see if I’ve already loaded it or not.

Adding FxCop to Your Build File

The next stop of course is to actually run FxCop on your assemblies and see what happens. So, without further ado, here is the target:

<target name=”fxcop” depends=”build” description=”Runs the FxCop tool over the set of libraries”>
<fxcop>
<targets>
<include name=”${build.dir}\*.dll” />
</targets>
<arg value=”/out:${reports.dir}\fxcop.xml” /> <!– Change the directory where the output is saved  –>
<arg value=”/directory:${lib.entlib.dir}” /> <!– Look in the entlib directory for supporting libraries used in the project –>
<!– <arg value=”/rid:-Microsoft.Design#CA2210″ />  - Example of ignoring a specific rule - Ignore the Strong Naming Rule –>
<arg value=”/fo” /> <!– Force output even if there are no violatons –>
</fxcop>
</target>

This target is running FxCop on the specified libaries in the build directory. It saves the output file to a specific location (which our CI server can save as an artifact). It also looks in a directory where other used libaries are located (in the case that they aren’t all in your build directory). Finally, I added a flag to force output even when there are no violations (/fo). This ensures a report artifact is generated without using a bunch of if statements in my CI’s NAnt file.

Another nice thing about FxCop that does not occur with CAT.NET is that it will fail the build automatically when it finds violations. When violations are found the return code from the command line utility is greater than 0 and NAnt will automatically fail the build unless you specify failonerror=”false”. Therefore, you don’t need a lot of extra build file code to check for errors with this utility.

Common Errors - Assembly Not Strongly Named

The first error I ran into was the strong naming error (rule Microsoft.Design#CA2210). Basically, Microsoft likes all of their assemblies to be strongly named (cryptographically signed with a private key). To get around this, we need to sign our assemblies. Finding information on how to do this can be a little tricky, but the jist of it is:

1. Open a Visual Studio 2005/2008 Command Prompt from the Start Menu (Start->Programs->Microsoft Visual Studio 2008->Visual Studio Tools->Visual Studio Command Prompt)
2. Change to your project directory (cd C:\Dev\Project1)
3. Run the command to generate a keyfile (sn.exe -k Project1.snk)
   1. You can also seperate the public/private key in the case where your private key is only available to a small group of people and others use the public key by running: sn -p Project1.snk PublicProject1.snk
4. Define a property in your project specifying the path to the keyfile (<property name=”assembly.keyfile” value=”${root.dir}\Project1.snk” />)
5. On your csc tasks add the following attribute: keyfile=”${assembly.keyfile}”

That’s it. Your assemblies will now be strongly named, and the violation will go away in FxCop. Obviously you may want to take this a step further and delay sign them and keep your private key available only in a secured location where deployment occurs.

Common Errors - Assembly Information Missing

The next error also deals with assembly attributes. When you define a new project in Visual Studio, it automatically adds an AssemblyInfo.cs file which contains things like the assembly title, description, copyright, keyfile, and more. there are a whole list of Assembly<Something>Attribute decorators you can use in your assembly. I have created a target that is called in all my compile targets right before I run csc that generates an AssemblyInfo.cs file for each project. The nice thing is that this lends itself to automating your versioning (another article) if you so choose. The target and an example of how I use it is below:

<target name=”GenerateAssemblyFile” description=”Generates an AssemblyInfo.cs File for inclusion in the compile methods”>
<asminfo output=”${compile.dir}\AssemblyInfo.cs” language=”CSharp”>
<imports>
<import namespace=”System” />
<import namespace=”System.Reflection” />
<import namespace=”System.EnterpriseServices” />
<import namespace=”System.Runtime.InteropServices” />
</imports>
<attributes>
<attribute type=”ComVisibleAttribute” value=”false” />
<attribute type=”CLSCompliantAttribute” value=”true” />
<attribute type=”AssemblyVersionAttribute” value=”${assembly.version}” />
<attribute type=”AssemblyTitleAttribute” value=”${assembly.title}” />
<attribute type=”AssemblyDescriptionAttribute” value=”${assembly.description}” />
<attribute type=”AssemblyCopyrightAttribute” value=”${assembly.copyright}” />
<attribute type=”ApplicationNameAttribute” value=”${assembly.name}” />
</attributes>
<references>
<include name=”System.EnterpriseServices.dll” />
</references>
</asminfo>
</target>

And the compile target that calls it:

<target name=”compile.models” depends=”init”>
<property name=”compile.dir” value=”${project::get-name()}.Models” />
<property name=”assembly.title” value=”Models Library” />
<property name=”assembly.description” value=”Models Library for the MVC framework” />
<property name=”assembly.name” value=”${project::get-name()}.Models” />
<call target=”GenerateAssemblyFile” />

<csc target=”library” output=”${build.dir}/${compile.dir}.dll” debug=”${debug.compile}” keyfile=”${assembly.keyfile}”>
<sources>
<include name=”${compile.dir}/**/*.cs” />
</sources>
<references>
<include name=”${build.base.dir}/.Services.Proxy.dll” />
</references>
</csc>
</target>

The target creates a bunch of properties to use in the GenerateAssemblyInfo target and then calls the genertion target. ${assembly.version} can be predefined, or you can use the NAntContrib ‘version’ task to automate the version number information.

Conclusion

FxCop is a great tool to help your team stick to recognized framework coding standards that include design time, performance, and security issues. It still does not replace a human code review and it should only be used to augment your code review processes.

Here is the new task:

<target name=”catnet” description=”Runs the CAT.NET static code analysis tool on a set of libraries”>
<exec program=”${root.dir}\Microsoft\CAT.NET\CatNetCmd.exe” workingdir=”.” output=”catnetout.log”>
<arg value=”/file:${build.dir}\${project::get-name()}.Models.dll” />
<arg value=”/file:${build.dir}\${project::get-name()}.Views.dll” />
<arg value=”/file:${build.dir}/${project::get-name()}.Presenters.dll” />
<arg value=”/file:${build.dir}/${project::get-name()}.Web.dll” />
<arg value=”/report:${reports.dir}\CatNetReport.xml” />
<arg value=”/reportxsloutput:${reports.dir}\CatNetReport.html” />
</exec>

<!– Check for errors since the command doesn’t throw error codes –>
<loadfile file=”catnetout.log” property=”catnetout” />
<fail if=”${string::contains(catnetout, ‘ERROR’)}” message=”There was an error running CAT.NET Static Analysis” />
<!– Clean up if we didn’t error out –>
<delete file=”catnetout.log” />

<xmlpeek file=”${reports.dir}\CatNetReport.xml”
property=”hasErrors”
xpath=”//Rule[TotalResults>0]/Results/Result/ProblemDescription” failonerror=”false” />
<if test=”${property::exists(’hasErrors’)}”>
<fail if=”${string::get-length(hasErrors) &gt; 0}” message=”CAT.NET found at least one problem: ${hasErrors}” />
</if>
</target>

CAT.NET Installation

The first thing to do is download the CAT.NET MSI installer. Then either unpack it or do what I did and install it, copy the files from C:\Program Files\Microsoft\CAT.NET to your project directory, and uninstall. I  like to keep all tools contained within the svn repositories for a project so they can be utilized on any development computer without having to set it up first.

One funny thing with CAT.NET (CISG take note) is that it has to live in a specific path within the project repository. When it was put in {root.dir}\tools\CAT.NET it failed to find the config files, default rules files, etc. It was looking for them at Microsoft\CAT.NET so I broke with my standards (laziness really) and moved it to {root.dir}\Microsoft\CAT.NET. The tool is much happier there and still available in the build file.

Basics of The Project

The demo project is a website that takes in a cat’s name, tail length, and color and then repeats them back to the page (”You have entered: <name>, <tail length>, <color>”). When the user fills in the textboxes and clicks submit, the page creates a CatContext object, fills it with the values taken from the page, and passes it to a CatEngine object. The CatEngine.GetMyCat() method returns the values and they are put in ASP Labels on the page - lblName.Text = cEngine.GetMyCat().Name, etc etc. The CatEngine and CatContext classes are defined in the ClassLibrary1 project (original eh?) and the website code (Default.aspx) is in the WebApplication1 project.

The important thing to note with this project is that the CatEngine does not do any cleaning or validation on the input or output. This is a clear cut example of a Cross Site Scripting vulnerability (and possibly a SQLi vulnerability if the input were eventually put in a database). Both of these situations are caught with CAT.NET, so it is a good tool to have in your build process.

Project Repository Layout

The following is the layout of the project repository (in the root.dir):

• ClassLibrary1\
  • bin\
  • CatContext.cs - A value object for holding information about a cat (name, tail length, and color)
  • CatEngine.cs - The “business object” that takes in a CatContext object and has a method - CatContext GetMyCat() that returns the object
  • ClassLibrary1.csproj
• Microsoft\CAT.NET\
  • Config\
  • Rules\
  • CatNetCmd.exe
  • Other CAT.NET files (from the download) *
• tools\
  • nant\
    • nant.exe
    • Other nant files
• WebApplication1\
  • Default.aspx - The page with the XSS vulnerability in it
  • Default.aspx.cs - The code behind for the page
  • web.config
  • WebApplication1.csproj
• build.bat - Easy way to run nant - (Tools\nant\NAnt.exe -buildfile:default.build %* -nologo)
• default.build - The build file for the solution
• Solution1.sln

The Build File

The build file is a typical NAnt build file with the following properties and targets

• Properties
  • build.dir - Directory to put the output from the csc task (C# Source Compiler)
  • dist.dir - Directory to put all file that are necessary for a deployment of the application to a webserver (also where the local IIS is configured to look when manually testing the site)
  • artifacts.dir - Directory to hold reports generated from NUnit, CAT.NET, FxCop, and other tools that generate XML and HTML reports
• Targets
  • init - Creates the build.dir and dist.dir
  • clean - Deletes build.dir, dist.dir, and artifacts.dir for a clean environment
  • compile.catengine - Compiles the ClassLibrary1 project into ${build.dir}\ClassLibrary1.dll
  • compile.web - Compiles the website code behind files into ${build.dir}\WebApplication1.dll
    • This target depends on compile.catengine
  • build - Runs all the necessary targets to build the libraries and put them in the build directory
    • Depends on clean, init, compile.catengine, compile.web (in that order)
  • dist - Depends on ‘build’ and copies the libraries and the website pages (Default.aspx) to the ${dist.dir} for deployment
    • Depends on ‘catnet’
  • catnet - Runs the CAT.NET code analysis tool on the libraries and checks for errors. If any are found the build if failed and the distribution package never completes.

The ‘catnet’ Target

This is the bread and butter of the CAT.NET automation. You can get a sense of the command line options we use by running CatNetCmd.exe /?. Here is the code:

<target name=”catnet” description=”Runs the CAT.NET static code analysis tool on a set of libraries”>
<exec program=”Microsoft\CAT.NET\CatNetCmd.exe” workingdir=”.” output=”catnetout.log”>
<arg value=”/file:${build.dir}\ClassLibrary1.dll” />
<arg value=”/file:${build.dir}\WebApplication1.dll” />
<arg value=”/report:${artifacts.dir}\CatNetReport.xml” />
<arg value=”/reportxsloutput:${artifacts.dir}\CatNetReport.html” />
</exec>

<!– Check for errors since the command doesn’t throw error codes –>
<loadfile file=”catnetout.log” property=”catnetout” />
<fail if=”${string::contains(catnetout, ‘ERROR’)}” message=”There was an error running CAT.NET Static Analysis” />
<!– Clean up if we didn’t error out –>
<delete file=”catnetout.log” />

<xmlpeek file=”${artifacts.dir}\CatNetReport.xml”
property=”hasErrors”
xpath=”//Rule[TotalResults>0]/Results/Result/ProblemDescription” />

<fail if=”${string::get-length(hasErrors) &gt; 0}” message=”CAT.NET found at least one problem: ${hasErrors}” />
</target>

This target runs the CAT.NET tool over the libraries produced from the ‘build’ target. It uses the default rule set and outputs the reports to ${artifacts.dir}\CatNetReport.xml and CatNetReport.html. Because the CAT.NET command line tool does not return an error code (CISG again), the build file sends the output to catnet.log file, read it in, and check for the word ‘ERROR’. If that is found, the build is failed because something went wrong with the command itself.

If the command completes successfully it cleans up the standard output file (delete catnet.log) and then performs an XMLPeek on the CatNetReport.xml file. The xmlpeek xpath looks for a <TotalResults>#</TotalResults> where # is greater than zero. Unfortunately the xmlpeek command only pulls the first record it comes across that matches the xpath, but that is enough to know that the build needs to be failed. If even one error is reported from this utility, the build should stop anyway and a manual check of the report shoud be performed. The CI process should include some way of notifying developers of errors like this but for this is an example those targets were not included.

Analyzing the Output

When the build is run (’build dist’), the output of the catnet target looks like the following:

catnet:

[exec] Application Assurance
[exec] Static Analysis Tool
[exec] 1.0.3272.32340
[exec]
[exec] 12/31/2008 4:13:38 PM:Info : Starting analysis [2 modules]
[exec] 12/31/2008 4:13:38 PM:Info : Analyzing module ClassLibrary1…
[exec] 12/31/2008 4:13:38 PM:Info : Analyzing module WebApplication1…
[exec] 12/31/2008 4:13:39 PM:Info : 2 Cross-Site Scripting issues found.
[exec] 12/31/2008 4:13:39 PM:Info : Analysis completed.
[delete] Deleting file C:\Dev\CatNetExample\catnetout.log.
[xmlpeek] Peeking at ‘C:\Dev\CatNetExample\reports\CatNetReport.xml’ with XPath expression ‘//Rule[TotalResults>0]/Results/Result/ProblemDescription’.
[xmlpeek] Found ‘2′ nodes with the XPath expression ‘//Rule[TotalResults>0]/Results/Result/ProblemDescription’.

BUILD FAILED

C:\Dev\CatNetExample\default.build(70,4):
CAT.NET found at least one problem: A cross-site scripting vulnerability was found through  a user controlled variable that enters the application at  Default.aspx.cs:27 through the variable stack0 which  eventually leads to a cross-site scripting issue at  Default.aspx.cs:29.

Total time: 3.1 seconds.

The tool finds an XSS defect and fails the build. There are a few more errors found, but it stops on the first occurance of an error. CAT.NET can be customized to find all kinds of coding problems and it is recommended to customize the configuration for your specific needs. Once it is configured don’t forget to include it in the build process!

Conclusion

CAT.NET is a great tool and it should only get better over time. I sleep better at night knowing that I am catching common security errors, my junior developers (if I had any) learn from their mistakes using automation, and I can cut down the time I spend doing manual code reviews. The next article will look at the use of FxCop to help your project adhere to coding standards. I use the default Microsoft standard set because I’m insane, but you can also customize this tool to your liking.

Sadly I’m going to count this as my blog quotient for the day! Check back tomorrow for more exciting tech writing!

I’ve started to put this tool, as well as FxCop, into my build process. The biggest headache in the CAT.NET automation process is defining the sources and sinks necessary for the tool to be effective. Some of this can be autogenerated using XML comments in the code, and as I explore this more I’ll give some details here.

Over the next week I’m going to be publishing a series of articles detailing how to automate these tools to make your code more secure and best practices compliant. It will also help reduce your manual code review process (you do have a code review process in place, don’t you?) because these tools are designed to catch the most common errors that take up a lot of time during a human review.

I started looking at the phones (at Wal-mart no less) and saw that they had the iPhone. From my earlier post you probably saw that I was happy with the phone before, but I didn’t like the missing API and the lack of applications. Well, with that solved, it was time to take another look.

My line was eligible for an upgrade as well and I took the opportunity to give the old Samsung the heave ho and purchased an 8 GB iPhone. I’ve already activated it, updated it, synced my contacts, email, and calendar with it, and installed an SSH client and a VPN client. In under an hour! I’m much happier now and I think in time I’ll be pulling down the API docs and having a look at those as well.

The truth though is that I really wanted a Google Android based phone. They are supposed to be coming into the line up in 2009 sometime, but I wasn’t willing to wait that long for a better alternative to the Blackjack II.

I feel so ripped off! When they first released the iPhone I purchased one at the AT&T store. The price was steep, the phone was cool, and the fact that I had to sign up for more than a basic data plan was less than appealing. I ended up taking my iPhone back on principle - they did not have an open API to develop applications on it.

To have the hands down best phone on the market and restrict improvements from the world at large was something I wasn’t ready to stomach. That is the same mentality that has stopped me from buying anything from Apple for years and years. Sure, it is possible to  jailbreak the iPhone and void the support contract and risk not getting updates, or worse turning the phone into a brick. But did I really want to do that when the innovators of the industry should know better?

Worst Exchange Ever

I returned my iPhone and bought a Blackjack II instead. I am still required to have the data plan, but I downgraded it right after the purchase. The OS is Windows Mobile 6 (meaning the development API is well documented) and I could install my own apps on it. I’m not very happy with the interface or some of the features, but all in all it isn’t a bad phone. Still, I see my friend with their iPhones and all the functionality I want, plus a rich API and a single repository for purchasing applications, and I wonder why I made the wrong choice.

The Applications Nightmare

Then the nightmare began. I started looking for VPN, SSH, and remote desktop applications for my Blackjack II. I haven’t found squat! What’s worse, every time I search for applications I end up at this horrible Microsoft site that reminds me of a forgotten orphan child. They have an application download section - that requires registration forfull access - with about 4 applications.

Wish List

All I really need is a VPN client that supports common VPN configurations and an SSH client. I remote manage some important servers for my job, and if I’m away from my desk I will have no way with this expensive “smart phone” to access these resources. I will continue my search and maybe if I get enough requests I’ll go ahead and code my own. If you think this is a good idea, let me know and I’ll start asking for feature requests and other developers.